Swap zero/O
dark0de reads like darkode at a glance
Why do v2 and v3 onion addresses look so different, and does the length alone tell me anything?
Yes: a v2 onion address is a short string of 16 base32 characters followed by .onion, while a v3 address is 56 base32 characters followed by .onion. That length difference alone tells you which cryptographic generation you are looking at, but it does not tell you whether the address is genuine — so learning how to recognise plausible typos or spoofed mirrors still depends on other checks.
The old v2 format used an 80-bit public key and a truncated hash, which is why the human-visible part stayed short. The v3 format uses a longer ed25519 public key, a version byte, and a checksum, producing that long 56-character string. In practice, v2 addresses are no longer supported by current Tor Browser releases, so if someone shares a short “onion” link today, it is either a historical reference or a trap that will not open properly.
What the length can and cannot tell you
- Seeing a 16-character .onion linktreat it as legacy, broken, or deliberately misleading
- Seeing a 56-character .onion linkrecognise the modern format but do not assume it is safe
- Spotting a 55- or 57-character stringsuspect a typo, a copy-paste error, or a spoofed mirror
Think of the address like a house number. A longer house number might belong to a newer street grid, but it does not prove the house is the friend’s home you meant to visit. A single missing character in a v3 address almost always points to a different service — often one built to look familiar.
Important
Never “correct” a slightly distorted onion address by guessing a missing or swapped character. If the copied link is malformed, discard it and get a fresh reference from a source you already trust.
What makes a spoofed mirror look “right enough” to fool a careful person?
A spoofed mirror is not convincing because it copies the whole site; it is convincing because it copies the part your eyes actually check — the first few characters, the last few characters, and the overall shape. The middle of a v3 onion address is 56 base32 characters, and almost nobody reads all of them. Attackers exploit that scanning habit.
Where your eyes skip
When you glance at an address, your brain creates a “visual checksum”: it remembers length, a couple of letters near the start, and maybe the ending. A fake address like facebookcorewwwi.onion vs faceb00kcorewwwi.onion survives because the middle carries no meaning to a tired reader. In v3 addresses, attackers make a new keypair until they get the same first 2–3 and last 2–3 characters, then publish that look-alike.
1Read full addressbrain stores only first 3 and last 3 characters
2Attacker picks close characters
7abc…xyz vs 7acb…xzy3Directory lists both namesfake sits next to real entry
4User pastes wrong linkexpected padlock or warning never appears
5Credentials sent to wrong endpointfake mirror records them
The small swaps that survive
Move one letter
zonatools vs zoantools — invisible in lowercase
Repeat a doubled letter
shopvvorld vs shopworld — extra v hides in monospace
Add a hyphen or dot
market-place vs marketplace — directory typo, not brand
Replace a rare letter
ru vs nu in lowercase at small font size
- Character confusion
- Prefix cloning
- Suffix matching
The practical lesson for a parent or team lead: do not compare “beginning and end.” Pick three separated slices — for example characters 8–11, 30–33, and 52–55 — and compare those against a source you already trust. If the fake was built to match the edges, the middle slices will not align.
Important
A valid onion address has exactly 56 characters after the protocol and before onion — no dashes, no dots, no uppercase letters. A fake directory sometimes shows 56-character-looking strings with extra symbols to confuse the count.
Tip
When two links arrive from different people and differ by only one character, treat both as untrusted until you open neither.
Can I trust a link just because it came from a signed index or a community thread?
A signed index or a community thread can make a link more likely to be genuine, but it cannot make it safe on its own. The signature proves only one thing: whoever controls the signing key approved that exact text at some point in the past. It does not prove that the person is honest, that the key was not stolen, or that the link still points where it did when the note was signed.
Think of a signature as a wax seal on an envelope. The seal shows the envelope has not been opened since it was sealed, but it does not tell you who really owns the ring, whether the letter inside is true, or whether the address written on the paper is the one you meant to visit.
What the signature actually covers
A signature covers the bytes that were signed, not the web page you are looking at. If a post says "the market address is abc123.onion" and that string is signed, then changing one character invalidates the signature. But the same key could also sign a different message tomorrow saying "the market address is abc124.onion" — and that new signature would also be valid.
- You see a PGP-signed message with an onion addressAsk: is the signature valid against the exact text?
- You are about to open
abc123.onionCompare every character of the address with the signed text, not just the first six or seven.
- The signature checks outThis confirms the message was not altered after signing, not that the address is run by the market.
- The thread was updated recentlyTreat a valid signature as one useful signal among several, never as a final answer.
A community thread is weaker still. Anyone can reply with a "verified mirror" and hope people copy it without checking. A thread with many replies and old accounts is not proof: accounts get sold, and forums get compromised. The fact that a link appears in a popular thread simply means many people saw it, not that many people verified it independently.
Tip
Keep a small, local list of addresses you have already used successfully. When a thread gives you a new address, compare it against your list — not against the thread's claim that it is official.
Important
A valid signature on a spoofed address is still dangerous. If the signer was tricked or compromised, the signature makes the fake look stronger, not safer.
In practice, the most useful check is this: the signed or referenced address must match the address you are about to open, character for character, with no "almost the same" exceptions. If the signed text says one address and the thread you are reading shows another, close the tab and start over from your own saved copy.
- Signature
- cryptographic proof that a specific message came from the holder of a private key and was not altered afterwards
- Signed index
- a list of links accompanied by a signature, which proves only the list's integrity at signing time
- Community thread
- a public discussion where links may be posted by anyone, with no guarantee of verification
What should I do before typing or pasting an onion address into Tor Browser?
Before you paste anything, treat the address like a shared password: one person reads it aloud slowly, another checks it against a known-good source, and nobody taps “connect” until both agree. That single habit removes most “close enough” mistakes before Tor Browser ever touches the link.
1Copy the candidate linkKeep it in a plain text editor, not directly in Tor Browser
2Read the address backwards onceAlmost every spoof relies on your brain auto-correcting the front of a string
3Compare it with one signed or long-kept referenceNot a fresh search result, and not a screenshot a stranger posted five minutes ago
4Ask one other person to read it aloudIf you are alone, say it out loud yourself
5Only then open it in Tor BrowserBy this point, a wrong character should already feel wrong
Important
Do not “fix” a suspicious address by retyping the wrong part from memory. Retyping from memory is exactly how a near-miss onion becomes a working phishing page.
A useful family or small-team rule is: the link is not ready until two people have checked it from two different copies. One person can be holding the address from an old signed list, while the other reads from the new message or forum post. If they disagree even once — even on a single character — the link is not ready.
What to re-read on the address itself
On a v3 onion, check the last three and first three characters, not the middle. The middle is too long for most people to hold in short-term memory, but the ends are where typos and spoofs tend to hide. On a v2 address, check the final four characters before the .onion suffix, because that is the checksum that catches accidental edits.
Tip
Say the suspicious part in a different accent or rhythm. It sounds silly, but it breaks the pattern your eyes expect to see.
If the link came with extra context — “official backup,” “new domain,” “same as before” — ask what evidence comes with that claim. A phrase like “same as before” should trigger a check of before: do you still have the old address, and do they match anywhere except the first eight characters?
1Assumption: “I recognise this link”Recognition is not verification
2Assumption: “It was posted by a known name”Names get impersonated more often than links get brute-forced
3Assumption: “It looks like the one I used last week”Check the last characters, not the overall shape
4Decision: open or waitWhen in doubt, wait for a second source you already trust
| Check | Weak check | Strong check |
|---|---|---|
| Read the link once | catches only huge errors | catches very little, gives false confidence ;; Compare ends of address |
Note
For a small team, make the rule boring: no onion link gets opened from a chat message until someone has pasted it into a team note and someone else has replied “checked.” The reply matters more than the check itself.
When a link opens but something feels slightly off, is it already too late to verify?
No — opening the page starts a new evidence phase. You are no longer verifying the link alone; you are comparing what the loaded page claims against what a trustworthy copy should look like. But act calmly: closing the tab is enough for most early mismatches, and logging in or entering anything is what actually converts a suspicion into damage.
What “slightly off” can look like after a page loads
Unexpected redirect chain
You opened abc.onion and moments later the address bar shows a different onion or an exit-hop pattern you never requested. Treat this as a red banner, not a cosmetic quirk.
Broken identity cues
A market that normally shows its own PGP-signed greeting, captcha style, or welcome layout suddenly asks for a “re-verification” or shows a nearly identical but blurrier logo. That gap is the fingerprint not matching.
In-page forms that should not exist
If the first screen pushes you to enter a mnemonic, private key, vendor password, or “decrypt your session” before you have even browsed, the page is asking for something a real index never needs.
Timing and language shifts
Rare mirrors load in fits, but a consistent pattern of unusual delays on clicks plus slightly off wording is a sign the copy is being served through a shim.
- Page loads with a visual cloneThe basic theme and market name match, so your guard drops for a second ;; One element does not match memory
Why a loaded page is still not a trusted page
Inside onion services, TLS-style assumptions do not transfer in the way people expect. A .onion address already provides transport encryption through Tor, so an extra padlock does not mean the page is the real market; it means the hidden service configured a certificate. A phishing clone can also have a certificate. What matters is whether the page content matches the signed, previously seen identity of the market — its PGP key, its layout fingerprints, its public announcements, and the exact onion address after any redirect.
- A real market does not normally redirect you to another onion immediately after load
- A signed index or saved note can tell you the expected first-screen fingerprint
- If the page looks right but asks for one extra step before browsing, treat that step as the attack surface
Important
Do not “test” a suspicious page by entering a fake password. Some clones collect attempts and use them to infer how cautious you are, while the real risk is any form interaction that sends data out before you have confirmed the page.
1Suspicious page opensstop before clicking any form field
2Compare to saved fingerprintnote the onion, PGP footer, and first screen
3If mismatch appearsclose the tab and restart Tor Browser with a new circuit
4If nothing feels wrongwait a few minutes before any login, and re-check the page after a circuit change
Tip
Before you next need to decide under stress, save one short text file or printed card with the exact onion and one or two visual fingerprints for each service your family or team trusts. A loaded page can only be judged against something already on your side.